KR101995176B1 - Method and system for reverse engineering using big data based on dynamic context - Google Patents

Abstract

Provided are a reverse engineering method utilizing big data based on a program execution context and a system thereof. According to one embodiment of the present invention, the reverse engineering method comprises the steps of: executing a program to be analyzed through a debugger; setting a break point in an instruction included in a region of interest of the program to be analyzed using the debugger; storing an execution context at a corresponding time point in a context database through an event handler for an event occurring in an instruction in which the break point is set; and generating information analysis results for the program to be analyzed by processing the data stored in the context database.

Description

TECHNICAL FIELD [0001] The present invention relates to a reverse engineering method and system using big data based on a program execution context,

The following description relates to a method for efficiently performing a large-sized binary analysis, more specifically, a reverse engineering method and system for efficiently storing and analyzing a context in which all program execution contexts are stored, To a computer program stored in a computer-readable recording medium for causing a computer to execute a method according to embodiments of the present invention, and a recording medium therefor.

Given an arbitrary program (binary or source code), analyzing and understanding the behavior of the program is called reverse engineering. Companies that sell finished products (binary) want their products to be difficult to reverse engineer because they contain the technology of their companies. Another example of a producer in a similar position is an attacker who creates and distributes malicious code. Conversely, you may need to analyze your program with only binaries. This is the case when you need to look for program vulnerabilities or understand how malicious code works. As such, the fight against spear and shield has been steadily continuing on the subject of reverse engineering, and it can not be concluded that certain directions are necessarily the right direction.

The present invention is a part of a field called " dynamic analysis " The most basic of the existing dynamic analysis methods is to use a tool called 'debugger'. The advantage of a debugger is that it can be used in a wide variety of environments and allows you to see the execution context of the program at the point of the program you want. The program operates on the basis of the code that contains the instruction and the execution context that is the execution background of the code. Therefore, the user can utilize the debugger to predict the next execution result at the point of the desired program and then proceed to the understanding of the program. Another alternative is static / dynamic binary modification. In general, these modifications can be used to understand the behavior of the program by inserting / modifying the functions desired by the user in units of functions / basic blocks / commands.

Analysis methods that help to understand the behavior of the program described above are sufficient to give the user all the information the program contains. However, the larger the size of a given program, the more time it takes for the user to read and process and requires a more efficient analysis method. Therefore, it is important to efficiently process the information obtained through debugger or binary modification. Depending on how effective and efficient this process is, the time it takes for the analyst to analyze the program is greatly affected. Accordingly, the present invention proposes storage of the execution context and efficient processing, and shows how efficient this proposal is.

Prior art document: U.S. Pat. No. 8,959,442 B2

Reverse engineering methods and systems that can quickly reduce the time required for analysts to understand the behavior of a program in a situation where the analyst needs to deal with a very large or complex binary size And a computer program stored on a computer-readable recording medium for causing a computer to execute a method according to embodiments of the present invention in combination with the computer, and a recording medium therefor.

Executing a program to be analyzed through a debugger; Setting a breakpoint at an instruction included in a region of interest of the analysis target program using the debugger; Storing an execution context at a corresponding point in the context database through an event handler for an event occurring in the instruction for which the breakpoint is set; And processing the data stored in the context database to generate an information analysis result for the analysis target program.

According to one aspect, the step of generating the information analysis result includes: processing data stored in the context database; And reporting information analysis results on the processed data using a visualization tool.

According to another aspect of the present invention, an index value indicating a sequence in which the execution context is stored may be included in a column of a table stored in the context database.

According to another aspect of the present invention, the execution context includes at least one of a register value and a memory state for the analysis target program at a time corresponding to the execution context.

A computer program stored on a computer readable recording medium in combination with a computer device for executing the reverse engineering method on a computer device.

There is provided a computer-readable recording medium on which a program for causing a computer device to execute the reverse engineering method is recorded.

A computer device, comprising: at least one processor implemented to execute instructions readable by the computer device, wherein the at least one processor executes a program to be analyzed via a debugger, A breakpoint is set in an instruction included in a region of interest of a target program, an execution context at a corresponding time is stored in a context database through an event handler for an event occurring in an instruction in which the breakpoint is set, And processing the data stored in the context database to generate an information analysis result for the analysis target program.

Even if the binary analyst has little understanding of the structure of the binary, it is easy to find a starting point for analyzing the structure of the program. This has the effect of shortening the time required for program analysis.

1 is a block diagram illustrating an example of a computing device in accordance with an embodiment of the present invention.
FIG. 2 is a diagram illustrating an example of a reverse engineering process according to an embodiment of the present invention.
3 is a diagram illustrating an example of a graph in which break points are set at all command points of a program and pc values at corresponding points are sequentially shown in an embodiment of the present invention.
4 is a diagram showing an example of a screen of a document creating program according to an embodiment of the present invention.
5 is a diagram illustrating an example of an epilogue portion of a memory dynamic allocator function in an embodiment of the present invention.
6 is a diagram showing an example of a graph showing esi register values at a point corresponding to the epilogue portion.
7 is a diagram showing an example of a screen of a document creating program according to an embodiment of the present invention.
8 is a diagram illustrating another example of a graph showing esi register values at a point corresponding to an epilogue portion of a memory dynamic allocator function, in an embodiment of the present invention.
9 is a diagram showing an example of a memory address in an embodiment of the present invention.
10 is a flowchart illustrating an example of a reverse engineering method according to an embodiment of the present invention.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

The reverse engineering method according to embodiments of the present invention may be implemented through a computer apparatus to be described later. At this time, a computer program may be installed and operated in accordance with an embodiment of the present invention, and the computer device may perform a method according to embodiments of the present invention under the control of a computer program that is executed. The above-described computer program may be stored on a computer-readable recording medium in combination with a computer apparatus to cause a computer apparatus to execute a method according to embodiments of the present invention.

1 is a block diagram illustrating an example of a computing device in accordance with an embodiment of the present invention. As described above, the reverse engineering method according to embodiments of the present invention can be executed by the computer apparatus 100 shown in FIG.

The computer device 100 may include a memory 110, a processor 120, a communication interface 130, and an input / output interface 140, as shown in FIG. The memory 110 may be a computer-readable recording medium and may include a permanent mass storage device such as a random access memory (RAM), a read only memory (ROM), and a disk drive. Herein, the non-decaying mass storage device such as the ROM and the disk drive may be included in the computer device 100 as a separate permanent storage device separate from the memory 110. [ The memory 110 may also store an operating system and at least one program code. These software components may be loaded into the memory 110 from a computer readable recording medium separate from the memory 110. [ Such a computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, a disk, a tape, a DVD / CD-ROM drive, and a memory card. In other embodiments, the software components may be loaded into the memory 110 via the communication interface 130 rather than from a computer-readable recording medium. For example, the software components may be loaded into the memory 110 of the computer device 100 based on the computer program installed by the files received via the network 160.

The processor 120 may be configured to process instructions of a computer program by performing basic arithmetic, logic, and I / O operations. The instructions may be provided to the processor 120 by the memory 110 or communication interface 130. [ For example, the processor 120 may be configured to execute instructions received in accordance with the program code stored in a recording device, such as the memory 110. [

The communication interface 130 may provide functionality for the computer device 100 to communicate with another device (e.g., the storage devices discussed above) via the network 160. For example, a request, command, data, file, or the like, generated by the processor 120 of the computer device 100 according to the program code stored in the recording device such as the memory 110, 160 to other devices. Conversely, signals, commands, data, files, etc., from other devices may be received by the computer device 100 via the communications interface 130 of the computer device 100 via the network 160. Data or the like received through the communication interface 130 can be transferred to the processor 120 or the memory 110 and the files and the like can be transferred to a storage medium that can be further included in the computer apparatus 100 Permanent storage).

The input / output interface 140 may be a means for interfacing with the input / output device 150. For example, the input device may include a device such as a microphone, a keyboard or a mouse, and an output device may include a device such as a display, a speaker, and the like. As another example, the input / output interface 140 may be a means for interfacing with a device having integrated functions for input and output, such as a touch screen. The input / output device 150 may be composed of the computer device 100 and one device.

Also, in other embodiments, the computing device 100 may include fewer or more components than the components of FIG. However, there is no need to clearly illustrate most prior art components. For example, the computer device 100 may be implemented to include at least some of the input / output devices 150 described above, or may further include other components such as a transceiver, database, and the like.

The communication method is not limited and may be applied to a communication method using a communication network (e.g., a mobile communication network, a wired Internet, a wireless Internet, a broadcasting network) May also be included. For example, the network 160 may be a personal area network (LAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN) , A network such as the Internet, and the like. In addition, the network 160 may include any one or more of a network topology including a bus network, a star network, a ring network, a mesh network, a star-bus network, a tree or a hierarchical network, It is not limited.

In the reverse engineering method according to the embodiments of the present invention, context collection at the time of execution of a program to be executed first is required. For example, a software breakpoint and a breakpoint handler approach can be utilized.

FIG. 2 is a diagram illustrating an example of a reverse engineering process according to an embodiment of the present invention. FIG. 2 shows a debugger 210, an event handler 220, and a context database 230.

For example, the computer apparatus 100 can execute a program to be observed by attaching a debugger 210 thereto. At this time, when a break point is set to all the instructions of the part of interest (or the entire program) in the program, an event is generated in the corresponding part. At this time, the computer device 100, The execution context at the time of execution can be stored in the context database 230. The exact context of the DB table is not important because the context to be extracted may vary from case to case, and the column of the table may contain a value for the index role to know the order in which the context is stored. An execution context may mean a register value or a memory state at the time the program is executed. For example, when executing the command 'mov eax, [ebx]' in the Intel architecture, the value in memory depends on the value of the ebx register when the program executes the same command but the execution context is different. The operation of the program or the machine executing the program may be changed.

The context database 230 constructed in this way can process necessary information according to the situation of the analyst and transmit sufficient information to the analyst through a proper visualization tool.

3 is a diagram illustrating an example of a graph in which break points are set at all command points of a program and pc values at corresponding points are sequentially shown in an embodiment of the present invention. At this time, as the value increases, the x-axis of the graph can correspond to a pc (program count) which means a command executed later, and the y-axis can express to which address the command is stored in the memory. During the extraction of these pc (program count) values, the target program performed the same kind of behavior 5 times as shown in the dashed box 310. Looking at the graph of FIG. 3, it is very clear which part of the program command is the code that performed that type of action. It is difficult to say that the part of the graph that represents the graph exactly matches the code that performed the kind of behavior, but it is natural to think that the probability that the code that performed the behavior in the vicinity of that code is very likely to exist. Since the graph of FIG. 3 is a relatively small and simple program, an example of a larger and more widely used program can also be seen.

4 is a diagram showing an example of a screen of a document creating program according to an embodiment of the present invention. 4 shows a part 400 of a screen displayed on a display device of an arbitrary computer device as a specific document file is opened using a document creating program widely used in any computer device. It can be assumed that the analyst wishes to analyze the process that occurs when a specific document file is opened using the document creation program. At this time, when a specific document file is opened in a certain computer device, information on how much memory dynamic allocator dynamically allocates memory in any computer device can be obtained by a method similar to the method of FIG.

Figure 5 is an illustration of an example epilogue portion of a memory dynamic allocator function in one embodiment of the present invention and Figure 6 is an example of a graph showing esi register values at a point corresponding to an epilogue portion. Fig. In the graph of FIG. 6, the x-axis means an instruction executed later as the value increases, and the y-axis expresses the value held by the esi register at the time of executing the instruction. The graph of FIG. 6 particularly shows the allocation of memory of a size smaller than 1000 (the size of an ESI (Extended Source Pointer) register value is less than 100). Here, the esi register value may mean the size value of the memory allocated by the memory allocation function. This value may be slightly different from the amount of memory the user requested for the system. At this time, no characteristic point can be found in the graph of FIG.

FIG. 7 is a diagram showing an example of a screen of a document creating program according to an embodiment of the present invention, and FIG. 8 is a block diagram showing an example of the memory dynamic allocator function lt; RTI ID = 0.0 > esi < / RTI > register values. 7 shows a portion 700 of a screen displayed on a display device of an arbitrary computer apparatus as a specific document file is executed by an arbitrary computer apparatus using the same document creating program as described with reference to Fig. In FIG. 4, a specific document file contains only one word "CODEGATE" whereas FIG. 7 shows an example in which a specific document file contains a plurality of identical words "CODEGATE ". At this time, in the graph of FIG. 8, the dotted box 810 continuously expresses a certain value. In this case, when the document creating program deals with the specific document file shown in FIG. 7, the analyst can know what size of the memory is being used dynamically, and if the memory space having the corresponding size is searched This will give you an additional understanding of what unit or structure the program is handling this document file.

9 is a diagram showing an example of a memory address in an embodiment of the present invention. 9, the dotted box 910 indicates that the character string written in the document exists in the memory space that can be confirmed through the actual memory address.

10 is a flowchart illustrating an example of a reverse engineering method according to an embodiment of the present invention. The reverse engineering method according to the present embodiment can be performed, for example, by the computer apparatus 100 described above. For example, the processor 120 of the computer device 100 may be implemented to execute control instructions in accordance with the code of the operating system or the code of at least one computer program that the memory 110 contains. Here, the processor 120 may cause the computer device 100 to perform steps 1010 through 1040, including the method of Figure 10, in accordance with a control command provided by a code stored in the computer device 100. [ Can be controlled. The at least one computer program described above may be a program installed in the computer device 100 for the reverse engineering method and may be a program separate from the analysis target program described later.

In step 1010, the computer device 100 may execute the analysis target program through a debugger. A debugger is, for example, a program that is used as an auxiliary to search for the cause of an error with respect to a program including an error. It traces a program or investigates a relational expression between specific variables for each phrase of a program. And may be a program used for detecting dynamic. The computer device 100 can execute the analysis target program using such a debugger program.

In step 1020, the computer device 100 may use the debugger to set a breakpoint on the instructions contained in the region of interest of the analysis target program. Breakpoints are places where software development is intended to temporarily or temporarily stop a program and can be used for debugging purposes. A breakpoint is used as a means to find out information about a program that is already running. In this situation, the analyzer checks various test environments (general purpose registers, memory, logs, files, etc.) So that the program can function as expected, and if not, what is the problem. Depending on the embodiment, the breakpoint may include a condition for aborting program execution at a desired instant.

In step 1030, the computer device 100 may store an execution context at a corresponding point in the context database through an event handler for an event occurring in an instruction for which a breakpoint is set. As described above, since the extracted context may differ depending on the case, the exact DB table type is not important, but a column of the table stored in the context database may include an index value indicating the order in which the execution context is stored have. On the other hand, the execution context may include a register value and / or a memory state for the analysis target program at a time corresponding to the execution context. As an example, we have previously described examples utilizing a PC value and / or an ESI register value.

In step 1040, the computer device 100 may process the data stored in the context database to generate an information analysis result for the analysis target program. At this time, the computer device 100 can process the data stored in the context database using the big data technology or the like to generate the information analysis result, and the information analysis result on the processed data using the visualization tool can be provided to the analyzer You can report. An example of the information analysis result to be reported has been described with reference to FIG. 4, FIG. 6, and FIG.

According to the embodiments of the present invention, it is possible to reduce the time required for analyzing a program by making it easy to find a starting point for analyzing the structure of a program even when the binary analyzer has a small understanding of the structure of the binary.

The system or apparatus described above may be implemented as a hardware component, or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device As shown in FIG. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The medium may be one that continues to store computer executable programs, or temporarily store them for execution or download. In addition, the medium may be a variety of recording means or storage means in the form of a combination of a single hardware or a plurality of hardware, but is not limited to a medium directly connected to a computer system, but may be dispersed on a network. Examples of the medium include a magnetic medium such as a hard disk, a floppy disk and a magnetic tape, an optical recording medium such as CD-ROM and DVD, a magneto-optical medium such as a floptical disk, And program instructions including ROM, RAM, flash memory, and the like. As another example of the medium, a recording medium or a storage medium managed by a site or a server that supplies or distributes an application store or various other software to distribute the application may be mentioned. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (10)

A method for reverse engineering performed by a computing device comprising at least one processor,
Executing, by the at least one processor, a program to be analyzed through a debugger;
Setting a breakpoint in each of the instructions included in the region of interest of the analysis target program by the at least one processor using the debugger;
Storing, by the at least one processor, an execution context at a corresponding point in the context database through an event handler for an event occurring in an instruction for which the breakpoint is set; And
Processing the data stored in the context database by the at least one processor to generate an analysis result of the analysis target program
Lt; / RTI >
Wherein the execution context includes at least one of a register value and a memory state for the analysis target program at a time corresponding to the execution context,
The step of generating the information analysis result includes:
Processing the data stored in the context database to generate an information analysis result including at least one of a sequence of register values according to a time and a sequence of a memory state according to time. The method according to claim 1,
The step of generating the information analysis result includes:
A step of reporting the information analysis result using a visualization tool
And a reverse engineering method. The method according to claim 1,
Wherein an index value indicating an order in which the execution context is stored is included in a column of a table stored in the context database. delete A computer program stored on a computer-readable medium for causing a computer device to execute the method of any one of claims 1 to 3 in combination with the computer device. A computer program for causing a computer apparatus to execute the method according to any one of claims 1 to 3. A computer device comprising:
At least one processor configured to execute instructions readable by the computer device
Lt; / RTI >
By said at least one processor,
The program to be analyzed is executed through the debugger,
Setting a breakpoint in each of the instructions included in the region of interest of the analysis target program using the debugger,
Storing an execution context at a corresponding point in the context database through an event handler for an event occurring in the instruction for which the breakpoint is set,
Processing the data stored in the context database to generate information analysis results for the analysis target program,
Wherein the execution context includes at least one of a register value and a memory state for the analysis target program at a time corresponding to the execution context,
Processing the data stored in the context database to generate the information analysis result by the at least one processor, wherein the at least one processor comprises at least one of a sequence of register values over time and a sequence of memory states over time, Generating information analysis results
The computer device comprising: 8. The method of claim 7,
By said at least one processor,
To report the above information analysis result using a visualization tool
The computer device comprising: 8. The method of claim 7,
Wherein an index value indicating an order in which the execution context is stored is included in a column of a table stored in the context database. delete

Images